See http://www.isg.rhul.ac.uk/tls/ cyassl suffers (as most ssl implementations) from a CBC timing attack. Mitigation measures are implemented in version 2.5.0.
Unfortunately cyassl-2.5.0 requires automake 1.12. A simple backport to 1.11 fails. I'll get it ready with WANT_AUTOMAKE=1.12 but we may have to want to put pressure on automake. This is now a well known vuln.
+*cyassl-2.5.0 (06 Feb 2013) + + 06 Feb 2013; Anthony G. Basile <blueness@gentoo.org> +cyassl-2.5.0.ebuild, + metadata.xml: + Version bump, sercurity fix, bug #455766 +
(In reply to comment #1) > Unfortunately cyassl-2.5.0 requires automake 1.12. A simple backport to 1.11 > fails. I'll get it ready with WANT_AUTOMAKE=1.12 but we may have to want to > put pressure on automake. This is now a well known vuln. I found a workaround in the build system so that the ebuild does not depend on automake 11.12. We're good to go for rapid stabilization. Please stabilize =net-libs/cyassl-2.5.0. TARGET"amd64 arm hppa ppc ppc64 x86"
Stable for HPPA.
ppc stable
ppc64 stable
amd64 stable
x86 stable
arm stable
GLSA vote: no.
CVE-2013-1623 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1623): The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
GLSA vote: no Closing as noglsa